1337skills.com

Appearance

Zeek Network Security Monitoring Framework Cheat Sheet ​

Overview ​

Zeek (formerly known as Bro) is a powerful network security monitoring framework that provides comprehensive network analysis and security monitoring capabilities. It operates by passively monitoring network traffic and generating detailed logs about network activity, protocols, and potential security threats. Zeek is widely used by security teams for network forensics, incident response, and continuous security monitoring in enterprise environments.

⚠️ Note: Zeek requires proper network access and configuration for effective monitoring. It should be deployed on network segments with appropriate traffic mirroring or TAP access.

Installation ​

Package Manager Installation ​

bash
# Ubuntu/Debian
sudo apt update
sudo apt install zeek

# CentOS/RHEL/Fedora
sudo dnf install zeek

# macOS with Homebrew
brew install zeek

# Verify installation
zeek --version

Source Installation ​

bash
# Install dependencies (Ubuntu/Debian)
sudo apt install cmake make gcc g++ flex bison libpcap-dev libssl-dev python3-dev swig zlib1g-dev

# Install dependencies (CentOS/RHEL)
sudo dnf install cmake make gcc gcc-c++ flex bison libpcap-devel openssl-devel python3-devel swig zlib-devel

# Download and compile Zeek
wget https://download.zeek.org/zeek-5.0.0.tar.gz
tar -xzf zeek-5.0.0.tar.gz
cd zeek-5.0.0

# Configure and build
./configure --prefix=/usr/local/zeek
make -j$(nproc)
sudo make install

# Add to PATH
echo 'export PATH="/usr/local/zeek/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

Docker Installation ​

bash
# Pull Zeek image
docker pull zeekurity/zeek

# Run Zeek in container
docker run -it --rm -v $(pwd):/data zeekurity/zeek zeek -r /data/capture.pcap

# Create custom Dockerfile
cat > Dockerfile << 'EOF'
FROM zeekurity/zeek
WORKDIR /data
COPY scripts/ /usr/local/zeek/share/zeek/site/
ENTRYPOINT ["zeek"]
EOF

docker build -t custom-zeek .

ZeekControl Installation ​

bash
# Install ZeekControl for cluster management
sudo apt install zeekctl

# Initialize ZeekControl
sudo zeekctl install
sudo zeekctl start

# Check status
sudo zeekctl status

Basic Configuration ​

Node Configuration (/usr/local/zeek/etc/node.cfg) ​

ini
# node.cfg - Zeek cluster configuration

[logger]
type=logger
host=localhost

[manager]
type=manager
host=localhost

[proxy-1]
type=proxy
host=localhost

[worker-1]
type=worker
host=localhost
interface=eth0

[worker-2]
type=worker
host=localhost
interface=eth1

Networks Configuration (/usr/local/zeek/etc/networks.cfg) ​

bash
# networks.cfg - Define local networks
10.0.0.0/8          Private
172.16.0.0/12       Private
192.168.0.0/16      Private

ZeekControl Configuration (/usr/local/zeek/etc/zeekctl.cfg) ​

bash
# zeekctl.cfg - ZeekControl configuration

# Mail configuration
MailTo = admin@example.com
MailSubjectPrefix = [Zeek]

# Logging configuration
LogRotationInterval = 3600
LogExpireInterval = 0

# Performance tuning
PFRINGClusterID = 21
PFRINGClusterType = 4

# Site-specific configuration
SitePolicyPath = /usr/local/zeek/share/zeek/site

Basic Usage ​

Running Zeek ​

bash
# Analyze live traffic on interface
sudo zeek -i eth0

# Analyze packet capture file
zeek -r capture.pcap

# Run with specific scripts
zeek -r capture.pcap protocols/http/detect-sqli

# Run with custom script directory
zeek -r capture.pcap /path/to/custom/scripts

# Run in background with logging
sudo zeek -i eth0 -S /usr/local/zeek/share/zeek/site/local.zeek

ZeekControl Commands ​

bash
# Start Zeek cluster
sudo zeekctl start

# Stop Zeek cluster
sudo zeekctl stop

# Restart Zeek cluster
sudo zeekctl restart

# Check cluster status
sudo zeekctl status

# Deploy configuration changes
sudo zeekctl deploy

# Check for crashed workers
sudo zeekctl cron

# Update and restart
sudo zeekctl install
sudo zeekctl restart

Log Analysis ​

bash
# View connection logs
cat /usr/local/zeek/logs/current/conn.log

# View HTTP logs
cat /usr/local/zeek/logs/current/http.log

# View DNS logs
cat /usr/local/zeek/logs/current/dns.log

# View SSL/TLS logs
cat /usr/local/zeek/logs/current/ssl.log

# View file transfer logs
cat /usr/local/zeek/logs/current/files.log

# Real-time log monitoring
tail -f /usr/local/zeek/logs/current/*.log

Log Types and Analysis ​

Connection Logs (conn.log) ​

bash
# Parse connection logs with zeek-cut
cat conn.log | zeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes

# Find long connections
cat conn.log | zeek-cut ts duration id.orig_h id.resp_h | awk '$2 > 3600'

# Find large data transfers
cat conn.log | zeek-cut ts orig_bytes resp_bytes id.orig_h id.resp_h | awk '$2+$3 > 1000000'

# Analyze connection states
cat conn.log | zeek-cut conn_state | sort | uniq -c | sort -nr

# Find failed connections
cat conn.log | zeek-cut ts id.orig_h id.resp_h conn_state | grep -E "(S0|REJ|RSTO)"

HTTP Logs (http.log) ​

bash
# Analyze HTTP requests
cat http.log | zeek-cut ts id.orig_h method host uri status_code

# Find suspicious user agents
cat http.log | zeek-cut user_agent | sort | uniq -c | sort -nr

# Detect potential SQL injection
cat http.log | zeek-cut ts id.orig_h host uri | grep -i "union\|select\|drop\|insert"

# Find file downloads
cat http.log | zeek-cut ts id.orig_h host uri resp_mime_types | grep -E "\.(exe|zip|rar|pdf)"

# Analyze HTTP status codes
cat http.log | zeek-cut status_code | sort | uniq -c | sort -nr

DNS Logs (dns.log) ​

bash
# Analyze DNS queries
cat dns.log | zeek-cut ts id.orig_h query qtype_name answers

# Find DNS tunneling indicators
cat dns.log | zeek-cut query | awk 'length($1) > 50'

# Detect DGA domains
cat dns.log | zeek-cut query | grep -E "[0-9a-f]{8,}"

# Find suspicious TLD usage
cat dns.log | zeek-cut query | grep -E "\.(tk|ml|ga|cf)$"

# Analyze query types
cat dns.log | zeek-cut qtype_name | sort | uniq -c | sort -nr

SSL/TLS Logs (ssl.log) ​

bash
# Analyze SSL certificates
cat ssl.log | zeek-cut ts id.orig_h id.resp_h server_name subject issuer

# Find self-signed certificates
cat ssl.log | zeek-cut ts server_name subject issuer | grep -E "subject.*issuer" | awk '$3 == $4'

# Detect weak SSL versions
cat ssl.log | zeek-cut ts version server_name | grep -E "SSLv|TLSv1$"

# Find certificate validation failures
cat ssl.log | zeek-cut ts server_name validation_status | grep -v "ok"

# Analyze cipher suites
cat ssl.log | zeek-cut cipher | sort | uniq -c | sort -nr

Custom Scripts and Detection ​

Basic Zeek Script Structure ​

zeek
# custom-detection.zeek

@load base/protocols/http

module CustomDetection;

export {
    # Define custom log record
    type Info: record {
        ts: time &log;
        uid: string &log;
        orig_h: addr &log;
        resp_h: addr &log;
        detection_type: string &log;
        details: string &log;
    };
    
    # Create custom log stream
    redef enum Log::ID += { LOG };
}

# Initialize logging
event zeek_init() {
    Log::create_stream(CustomDetection::LOG, [$columns=Info, $path="custom-detection"]);
}

# HTTP-based detection
event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) {
    # Detect SQL injection attempts
    if (/union.*select|drop.*table|insert.*into/i in unescaped_URI) {
        local info: Info = [
            $ts = network_time(),
            $uid = c$uid,
            $orig_h = c$id$orig_h,
            $resp_h = c$id$resp_h,
            $detection_type = "SQL_INJECTION",
            $details = fmt("Suspicious URI: %s", unescaped_URI)
        ];
        Log::write(CustomDetection::LOG, info);
    }
    
    # Detect XSS attempts
    if (/<script|javascript:|onload=|onerror=/i in unescaped_URI) {
        local info: Info = [
            $ts = network_time(),
            $uid = c$uid,
            $orig_h = c$id$orig_h,
            $resp_h = c$id$resp_h,
            $detection_type = "XSS_ATTEMPT",
            $details = fmt("Suspicious URI: %s", unescaped_URI)
        ];
        Log::write(CustomDetection::LOG, info);
    }
}

Advanced Detection Scripts ​

zeek
# advanced-threats.zeek

@load base/protocols/dns
@load base/protocols/http
@load base/protocols/ssl

module AdvancedThreats;

export {
    type ThreatInfo: record {
        ts: time &log;
        orig_h: addr &log;
        resp_h: addr &log;
        threat_type: string &log;
        confidence: string &log;
        indicators: string &log;
    };
    
    redef enum Log::ID += { THREAT_LOG };
    
    # Configurable thresholds
    const dns_query_threshold = 100 &redef;
    const http_request_threshold = 1000 &redef;
}

# Track DNS query counts per host
global dns_queries: table[addr] of count &create_expire=1hr;

# Track HTTP request counts per host
global http_requests: table[addr] of count &create_expire=1hr;

event zeek_init() {
    Log::create_stream(AdvancedThreats::THREAT_LOG, [$columns=ThreatInfo, $path="advanced-threats"]);
}

# DNS-based threat detection
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) {
    local orig = c$id$orig_h;
    
    # Increment query count
    if (orig !in dns_queries)
        dns_queries[orig] = 0;
    dns_queries[orig] += 1;
    
    # Detect DNS tunneling
    if (|query| > 50) {
        local threat_info: ThreatInfo = [
            $ts = network_time(),
            $orig_h = orig,
            $resp_h = c$id$resp_h,
            $threat_type = "DNS_TUNNELING",
            $confidence = "MEDIUM",
            $indicators = fmt("Long query: %s", query)
        ];
        Log::write(AdvancedThreats::THREAT_LOG, threat_info);
    }
    
    # Detect excessive DNS queries
    if (dns_queries[orig] > dns_query_threshold) {
        local threat_info: ThreatInfo = [
            $ts = network_time(),
            $orig_h = orig,
            $resp_h = c$id$resp_h,
            $threat_type = "DNS_EXFILTRATION",
            $confidence = "HIGH",
            $indicators = fmt("Query count: %d", dns_queries[orig])
        ];
        Log::write(AdvancedThreats::THREAT_LOG, threat_info);
    }
}

# HTTP-based threat detection
event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) {
    local orig = c$id$orig_h;
    
    # Increment request count
    if (orig !in http_requests)
        http_requests[orig] = 0;
    http_requests[orig] += 1;
    
    # Detect web shells
    if (/cmd=|exec=|system=|shell=/i in unescaped_URI) {
        local threat_info: ThreatInfo = [
            $ts = network_time(),
            $orig_h = orig,
            $resp_h = c$id$resp_h,
            $threat_type = "WEB_SHELL",
            $confidence = "HIGH",
            $indicators = fmt("Suspicious parameters: %s", unescaped_URI)
        ];
        Log::write(AdvancedThreats::THREAT_LOG, threat_info);
    }
    
    # Detect excessive HTTP requests
    if (http_requests[orig] > http_request_threshold) {
        local threat_info: ThreatInfo = [
            $ts = network_time(),
            $orig_h = orig,
            $resp_h = c$id$resp_h,
            $threat_type = "HTTP_FLOOD",
            $confidence = "MEDIUM",
            $indicators = fmt("Request count: %d", http_requests[orig])
        ];
        Log::write(AdvancedThreats::THREAT_LOG, threat_info);
    }
}

Intelligence Framework Integration ​

zeek
# intel-integration.zeek

@load frameworks/intel/seen
@load frameworks/intel/do_notice

module IntelIntegration;

export {
    # Define intelligence indicators
    type IntelData: record {
        indicator: string;
        indicator_type: Intel::Type;
        meta_source: string;
        meta_desc: string;
    };
}

# Load threat intelligence
event zeek_init() {
    # Add IOCs to intelligence framework
    Intel::insert([
        $indicator="malicious-domain.com",
        $indicator_type=Intel::DOMAIN,
        $meta=$source="ThreatFeed",
        $meta=$desc="Known C2 domain"
    ]);
    
    Intel::insert([
        $indicator="192.168.1.100",
        $indicator_type=Intel::ADDR,
        $meta=$source="Internal",
        $meta=$desc="Compromised host"
    ]);
}

# Custom intelligence matching
event Intel::match(s: Intel::Seen, items: set[Intel::Item]) {
    for (item in items) {
        print fmt("Intelligence match: %s (%s) - %s", 
                 s$indicator, s$indicator_type, item$meta$desc);
    }
}

Performance Tuning ​

Worker Configuration ​

bash
# /usr/local/zeek/etc/node.cfg
[worker-1]
type=worker
host=localhost
interface=eth0
lb_method=pf_ring
lb_procs=4
pin_cpus=0,1,2,3

[worker-2]
type=worker
host=localhost
interface=eth1
lb_method=pf_ring
lb_procs=4
pin_cpus=4,5,6,7

Memory and CPU Optimization ​

zeek
# performance-tuning.zeek

# Reduce memory usage
redef table_expire_interval = 10min;
redef table_incremental_step = 1000;

# Optimize connection tracking
redef tcp_content_deliver_all_orig = F;
redef tcp_content_deliver_all_resp = F;

# Limit file analysis
redef FileExtract::prefix = "/tmp/zeek-files/";
redef FileExtract::default_limit = 10MB;

# Optimize logging
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "gzip";

Network Interface Optimization ​

bash
# Optimize network interface for high-speed capture
sudo ethtool -G eth0 rx 4096 tx 4096
sudo ethtool -K eth0 gro off lro off tso off gso off
sudo ethtool -A eth0 rx off tx off

# Set CPU affinity for interrupts
echo 2 | sudo tee /proc/irq/24/smp_affinity
echo 4 | sudo tee /proc/irq/25/smp_affinity

Integration and Automation ​

ELK Stack Integration ​

bash
#!/bin/bash
# zeek-to-elasticsearch.sh

ZEEK_LOG_DIR="/usr/local/zeek/logs/current"
ELASTICSEARCH_URL="http://localhost:9200"

# Function to send logs to Elasticsearch
send_to_elasticsearch() {
    local log_file="$1"
    local index_name="zeek-$(basename "$log_file" .log)"
    
    # Convert Zeek logs to JSON and send to Elasticsearch
    cat "$log_file" | \
    zeek-cut -d | \
    jq -c '. | {index: {_index: "'$index_name'", _type: "_doc"}}, .' | \
    curl -s -H "Content-Type: application/x-ndjson" \
         -X POST "$ELASTICSEARCH_URL/_bulk" \
         --data-binary @-
}

# Monitor and send logs
inotifywait -m -e close_write "$ZEEK_LOG_DIR" | while read path action file; do
    if [[ "$file" =~ \.log$ ]]; then
        send_to_elasticsearch "$path/$file"
    fi
done

SIEM Integration ​

python
#!/usr/bin/env python3
# zeek-siem-integration.py

import json
import time
import requests
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler

class ZeekLogHandler(FileSystemEventHandler):
    def __init__(self, siem_endpoint):
        self.siem_endpoint = siem_endpoint
    
    def on_modified(self, event):
        if event.is_directory or not event.src_path.endswith('.log'):
            return
        
        self.process_log_file(event.src_path)
    
    def process_log_file(self, log_path):
        """Process Zeek log file and send to SIEM"""
        try:
            with open(log_path, 'r') as f:
                # Read new lines (simplified - should track position)
                lines = f.readlines()
                
                for line in lines:
                    if line.startswith('#') or not line.strip():
                        continue
                    
                    # Parse Zeek log line
                    log_entry = self.parse_zeek_log(line)
                    
                    # Send to SIEM
                    self.send_to_siem(log_entry)
        
        except Exception as e:
            print(f"Error processing {log_path}: {e}")
    
    def parse_zeek_log(self, line):
        """Parse Zeek log line to structured format"""
        fields = line.strip().split('\t')
        
        # Basic parsing (should be enhanced based on log type)
        return {
            'timestamp': fields[0] if len(fields) > 0 else '',
            'source': 'zeek',
            'raw_log': line.strip(),
            'fields': fields
        }
    
    def send_to_siem(self, log_entry):
        """Send log entry to SIEM"""
        try:
            response = requests.post(
                self.siem_endpoint,
                json=log_entry,
                headers={'Content-Type': 'application/json'},
                timeout=5
            )
            response.raise_for_status()
        
        except requests.RequestException as e:
            print(f"Error sending to SIEM: {e}")

def main():
    log_directory = "/usr/local/zeek/logs/current"
    siem_endpoint = "https://your-siem.com/api/logs"
    
    event_handler = ZeekLogHandler(siem_endpoint)
    observer = Observer()
    observer.schedule(event_handler, log_directory, recursive=False)
    
    observer.start()
    print(f"Monitoring Zeek logs in {log_directory}")
    
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        observer.stop()
    
    observer.join()

if __name__ == "__main__":
    main()

Automated Threat Response ​

bash
#!/bin/bash
# zeek-threat-response.sh

ZEEK_LOG_DIR="/usr/local/zeek/logs/current"
THREAT_LOG="$ZEEK_LOG_DIR/advanced-threats.log"
BLOCKED_IPS_FILE="/tmp/blocked_ips.txt"

# Function to block IP address
block_ip() {
    local ip="$1"
    local reason="$2"
    
    echo "$(date): Blocking IP $ip - $reason" >> /var/log/zeek-response.log
    
    # Add to iptables
    sudo iptables -I INPUT -s "$ip" -j DROP
    
    # Add to blocked IPs file
    echo "$ip" >> "$BLOCKED_IPS_FILE"
    
    # Send alert
    echo "ALERT: Blocked IP $ip due to $reason" | \
    mail -s "Zeek Threat Response" admin@example.com
}

# Monitor threat log
tail -F "$THREAT_LOG" | while read line; do
    if [[ "$line" =~ "HIGH" ]]; then
        # Extract IP address from log line
        ip=$(echo "$line" | awk '{print $3}')
        threat_type=$(echo "$line" | awk '{print $5}')
        
        # Check if IP is already blocked
        if ! grep -q "$ip" "$BLOCKED_IPS_FILE" 2>/dev/null; then
            block_ip "$ip" "$threat_type"
        fi
    fi
done

Monitoring and Alerting ​

Health Monitoring Script ​

python
#!/usr/bin/env python3
# zeek-health-monitor.py

import subprocess
import time
import smtplib
from email.mime.text import MIMEText
from datetime import datetime, timedelta

class ZeekHealthMonitor:
    def __init__(self):
        self.last_alert_time = {}
        self.alert_cooldown = timedelta(minutes=30)
    
    def check_zeek_processes(self):
        """Check if Zeek processes are running"""
        try:
            result = subprocess.run(['zeekctl', 'status'], 
                                  capture_output=True, text=True)
            
            if 'crashed' in result.stdout.lower():
                return False, "Zeek processes have crashed"
            
            if 'stopped' in result.stdout.lower():
                return False, "Zeek processes are stopped"
            
            return True, "All Zeek processes running"
        
        except Exception as e:
            return False, f"Error checking Zeek status: {e}"
    
    def check_log_freshness(self):
        """Check if logs are being generated"""
        import os
        
        log_dir = "/usr/local/zeek/logs/current"
        conn_log = os.path.join(log_dir, "conn.log")
        
        try:
            if not os.path.exists(conn_log):
                return False, "Connection log file not found"
            
            # Check if log was modified in last 5 minutes
            mtime = datetime.fromtimestamp(os.path.getmtime(conn_log))
            if datetime.now() - mtime > timedelta(minutes=5):
                return False, "Logs appear stale"
            
            return True, "Logs are fresh"
        
        except Exception as e:
            return False, f"Error checking log freshness: {e}"
    
    def check_disk_space(self):
        """Check available disk space for logs"""
        import shutil
        
        try:
            total, used, free = shutil.disk_usage("/usr/local/zeek/logs")
            free_percent = (free / total) * 100
            
            if free_percent < 10:
                return False, f"Low disk space: {free_percent:.1f}% free"
            
            return True, f"Disk space OK: {free_percent:.1f}% free"
        
        except Exception as e:
            return False, f"Error checking disk space: {e}"
    
    def send_alert(self, subject, message):
        """Send email alert"""
        alert_key = subject
        now = datetime.now()
        
        # Check cooldown
        if (alert_key in self.last_alert_time and 
            now - self.last_alert_time[alert_key] < self.alert_cooldown):
            return
        
        try:
            msg = MIMEText(message)
            msg['Subject'] = f"Zeek Alert: {subject}"
            msg['From'] = "zeek-monitor@example.com"
            msg['To'] = "admin@example.com"
            
            # Send email (configure SMTP settings)
            # smtp = smtplib.SMTP('localhost')
            # smtp.send_message(msg)
            # smtp.quit()
            
            print(f"ALERT: {subject} - {message}")
            self.last_alert_time[alert_key] = now
        
        except Exception as e:
            print(f"Error sending alert: {e}")
    
    def run_health_checks(self):
        """Run all health checks"""
        checks = [
            ("Process Status", self.check_zeek_processes),
            ("Log Freshness", self.check_log_freshness),
            ("Disk Space", self.check_disk_space)
        ]
        
        for check_name, check_func in checks:
            try:
                status, message = check_func()
                
                if not status:
                    self.send_alert(check_name, message)
                else:
                    print(f"{check_name}: {message}")
            
            except Exception as e:
                self.send_alert(check_name, f"Check failed: {e}")
    
    def monitor(self, interval=300):
        """Continuous monitoring loop"""
        print("Starting Zeek health monitoring...")
        
        while True:
            try:
                self.run_health_checks()
                time.sleep(interval)
            
            except KeyboardInterrupt:
                print("Monitoring stopped")
                break
            except Exception as e:
                print(f"Monitoring error: {e}")
                time.sleep(60)

if __name__ == "__main__":
    monitor = ZeekHealthMonitor()
    monitor.monitor()

Best Practices ​

Security Configuration ​

zeek
# security-hardening.zeek

# Disable unnecessary protocols
redef PacketAnalyzer::default_analyzer = PacketAnalyzer::ANALYZER_ETHERNET;

# Limit resource usage
redef table_expire_interval = 10min;
redef max_pending_trace_flushes = 10;

# Secure logging
redef Log::default_logdir = "/var/log/zeek";
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_postprocessor_cmd = "gzip";

# Network security
redef ignore_checksums = F;
redef partial_connection_ok = F;

Performance Optimization ​

bash
# System-level optimizations

# Increase network buffer sizes
echo 'net.core.rmem_max = 134217728' >> /etc/sysctl.conf
echo 'net.core.wmem_max = 134217728' >> /etc/sysctl.conf
echo 'net.core.netdev_max_backlog = 5000' >> /etc/sysctl.conf

# Optimize CPU scheduling
echo 'kernel.sched_migration_cost_ns = 5000000' >> /etc/sysctl.conf

# Apply changes
sysctl -p

Log Management ​

bash
#!/bin/bash
# zeek-log-management.sh

LOG_DIR="/usr/local/zeek/logs"
ARCHIVE_DIR="/var/archive/zeek"
RETENTION_DAYS=30

# Compress old logs
find "$LOG_DIR" -name "*.log" -mtime +1 -exec gzip {} \;

# Archive logs older than 7 days
find "$LOG_DIR" -name "*.log.gz" -mtime +7 -exec mv {} "$ARCHIVE_DIR/" \;

# Delete archived logs older than retention period
find "$ARCHIVE_DIR" -name "*.log.gz" -mtime +$RETENTION_DAYS -delete

# Generate daily summary
zeek-cut -d ts id.orig_h id.resp_h proto service < "$LOG_DIR/current/conn.log" | \
awk '{print $1, $2, $3, $4, $5}' | \
sort | uniq -c | sort -nr > "/tmp/zeek-summary-$(date +%Y%m%d).txt"

Troubleshooting ​

Common Issues ​

bash
# Issue: Zeek not capturing traffic
# Check interface and permissions
sudo zeek -i eth0 -v

# Check interface is up and has traffic
sudo tcpdump -i eth0 -c 10

# Issue: High memory usage
# Monitor memory usage
ps aux | grep zeek
cat /proc/$(pgrep zeek)/status | grep VmRSS

# Optimize memory settings
echo 'redef table_expire_interval = 5min;' >> /usr/local/zeek/share/zeek/site/local.zeek

# Issue: Missing logs
# Check log directory permissions
ls -la /usr/local/zeek/logs/current/

# Check disk space
df -h /usr/local/zeek/logs/

# Issue: Cluster communication problems
# Check node configuration
zeekctl config

# Test cluster connectivity
zeekctl netstats

Debug Mode ​

bash
# Enable debug logging
zeek -i eth0 -d

# Verbose output
zeek -i eth0 -v

# Check script syntax
zeek -a /path/to/script.zeek

# Test configuration
zeekctl check

Resources ​

This cheat sheet provides comprehensive guidance for deploying and managing Zeek for network security monitoring. Regular updates and proper configuration are essential for effective threat detection.